How to Do an SEO Audit: the complete guide

An SEO audit is a systematic inspection of the factors that control your site's visibility in organic search: whether engines can crawl it, whether the right pages get indexed, whether the content deserves to rank, and whether anything is actively working against you. It examines the technical infrastructure, the pages themselves, the content strategy behind them, and the authority signals around them — and it ends in one deliverable: a prioritized list of fixes.

It helps to be equally clear about what an SEO audit is not, because most documents wearing the name fail one of these tests:

• It is not a tool export. Any crawler will generate four thousand "issues" on a mid-sized site within the hour. Most are noise, duplicates, or pedantry. The audit is the judgment applied to that export — which twenty of the four thousand actually move anything, and in what order.
• It is not a ranking report. Rankings are an output. The audit examines inputs: crawlability, indexation, content quality, internal architecture, link profile. If a document just restates where you rank, it has diagnosed nothing.
• It is not a one-time event. Sites regress constantly — a deploy ships a stray noindex, a plugin rewrites robots.txt, a redesign buries the H1. A point-in-time audit is a snapshot of a moving target, which is why the audit habit matters more than any single audit document.

A finished audit contains three things per finding: the evidence (specific URLs, crawl data, Search Console screenshots — not vibes), the blast radius (how many pages and how much traffic the issue touches), and the next action (specific enough that a developer or writer can pick it up without a meeting).

Run a full SEO audit at four trigger points, and keep a lighter automated check running between them:

1. When you take over a site. New client, new role, acquisition, agency handoff. Audit before you change anything — it establishes the baseline you will be measured against and surfaces the landmines the last team left behind.
2. When traffic drops. The audit's job here is differential diagnosis: is it tracking (analytics broke), indexing (pages fell out), technical (a deploy broke something), or external (algorithm update, competitor surge)? Each has a completely different fix, and panicked teams routinely treat one as another.
3. Around a migration. Once before — full crawl, redirect map, benchmark of rankings and indexed pages — and once after, to verify the redirects fired, the canonicals survived, and nothing important returns a 404. Most migration damage is detectable in the first week and fixable in the first month, if anyone is looking.
4. On a calendar. A full audit annually, a structured mini-audit quarterly. Not because something is wrong — because the only way to know nothing is wrong is to check.

Between those points, the real failure mode is silence. Sites change weekly — deploys, CMS edits, plugin updates, third-party scripts — and each change can quietly break something no human will notice until the traffic graph does. This is the argument for continuous crawling alongside the annual deep dive: a scheduled crawl catches the stray noindex the week it ships, not eight months later when someone finally asks why the category pages disappeared.

Every audit starts with a crawl, because a crawl is the only view of your site that matches what engines actually experience. Your CMS shows what should exist; your analytics shows what gets visited; only a crawler — following links from the homepage outward, the way Googlebot does — shows what is actually reachable, what status code it returns, and what each page declares about itself.

Configure the crawl to behave like an engine, not like a sitemap reader:

• Crawl by following links, starting from the homepage — not just by reading the sitemap. The difference between the two lists is itself a finding.
• Crawl with and without JavaScript rendering if your stack is JS-heavy, and diff the results. Content or links that exist only in the rendered version are invisible to most AI crawlers and expensive for Google.
• Respect robots.txt so you discover what engines are actually allowed to see — then separately list everything robots.txt blocks, and check each rule against intent.

Then do the single most productive exercise in technical auditing: reconcile three lists — the pages your crawler found, the pages in your XML sitemap, and the pages Google reports as indexed in Search Console. On a healthy site the three lists are nearly identical. Every mismatch is a finding:

• In the sitemap but not in the crawl → orphan pages. No internal links point to them, and engines treat unlinked pages as unimportant — because the site evidently does.
• In the crawl but not indexed → indexation problems: a noindex, a canonical pointing elsewhere, quality filtering ("Crawled — currently not indexed"), or crawl-budget waste.
• Indexed but in neither list → junk in the index: parameter URLs, staging leaks, retired paths, tag archives. Each one dilutes what engines think your site is about.

While you are in the crawl data, record crawl depth — how many clicks each page sits from the homepage. Money pages buried five clicks deep are a structural finding that no amount of on-page polish will fix.

A technical SEO audit asks one question seven ways: can engines reach, render, and index the pages that matter — and only those? Work through the checks in this order:

1. Indexation. Search Console's Page indexing report is ground truth. You are not checking how many pages are indexed — you are checking whether the right pages are. Read every exclusion category: "Excluded by noindex" should contain only pages you chose to exclude; "Crawled — currently not indexed" at scale is usually a quality verdict, not a technical one; "Discovered — currently not indexed" at scale points to crawl-budget or internal-linking problems.
2. robots.txt. Read it line by line, slowly. In our experience, robots.txt produces the most catastrophic audit findings precisely because nobody re-reads it after launch. Verify every Disallow against intent, confirm it does not block the CSS and JavaScript files engines need for rendering, and confirm the Sitemap directive is present and points at the live sitemap.
3. XML sitemaps. A sitemap should contain every canonical, indexable, 200-status URL you want indexed — and nothing else. Sitemaps full of redirects, 404s, and noindexed pages teach engines to distrust the sitemap entirely. Honest lastmod dates matter, since freshness-aware crawlers use them to schedule revisits.
4. Canonicals. Every indexable page self-references; variants point at the canonical; nothing canonicalizes to a redirect or a 404. Then check what Google actually chose — the "Google-selected canonical" in URL inspection — against what you declared. Disagreement is a duplication or relevance finding wearing a technical disguise.
5. Redirects. Hunt for chains (A→B→C), loops, and 302s doing 301 jobs. Then fix the source, not just the symptom: internal links should point at final destinations, not ride redirects. After a migration, sample the old URL set and verify each lands on its mapped equivalent — not the homepage.
6. Core Web Vitals. Judge field data first — CrUX, what real users actually experienced — and use lab scores for diagnosis, not verdicts. Audit per template, not per URL: if the product-page template fails LCP, you have one finding with a thousand-page blast radius, not a thousand findings.
7. JavaScript rendering. Compare raw HTML against the rendered DOM for your key templates. Google will render JavaScript, eventually, at a cost; most other crawlers largely will not. Core content and navigation that exist only after hydration is one of the most common and least visible findings in a modern technical SEO audit — and it leads directly to the next layer.

This is the layer missing from every audit checklist written before 2023 — and skipping it now means auditing for a search landscape that no longer exists. A growing share of discovery happens inside AI answers: ChatGPT, Perplexity, Gemini, Claude, and Google's AI Overviews all answer questions directly and cite sources. Whether your site can be one of those sources is an auditable property, with concrete checks:

• AI crawler access. Check robots.txt for GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot, and Google-Extended. Many sites blocked these during the 2023 scramble — sometimes deliberately, often via a CDN bot-management default or a copied robots.txt template — and never revisited the decision. Then go deeper than robots.txt: check your CDN and WAF rules, because bot protection that silently serves 403s to AI crawlers achieves the same blackout without leaving a trace in robots.txt. Fetch your key pages with each crawler's user-agent string and look at the actual status code.
• llms.txt. An emerging convention: a markdown file at /llms.txt that gives AI systems a curated, plain-text map of your most important content. It is not an enforced standard and engines treat it inconsistently today — but it costs an hour, signals machine-readability intent, and is exactly the kind of cheap, asymmetric bet an audit should flag.
• Extractable structure. AI engines lift passages, not pages. Audit your key templates for headings that state the question, first sentences that answer it, self-contained paragraphs, real tables for comparisons, and lists for steps. The full discipline of writing for extraction is covered in our AEO guide; the audit's job is to flag templates where extraction is structurally impossible.
• Server-rendered substance. The JavaScript-rendering finding from the technical layer doubles in severity here: most AI crawlers fetch raw HTML and do not execute JavaScript. A site that looks complete in Google's index can be functionally blank to the crawler feeding ChatGPT.
• Entity clarity. Consistent Organization schema, sameAs links to your real profiles, one canonical name for the company everywhere it appears. AI engines decide whether to cite you partly on whether they can confidently resolve who you are.

Then measure the output side: are you actually being cited? Classic rank tracking says nothing here. You need per-engine citation tracking — which questions you appear in across ChatGPT, Perplexity, Gemini, Claude, and AI Overviews, and who gets cited when you do not. Aergos tracks AI citations alongside classic rankings for exactly this reason; the strategy discipline behind the measurement is the subject of our GEO guide.

On-page is the highest-ratio part of an SEO audit: the findings are cheap to fix, and the data needed to find them already lives in your crawl.

• Title tags. Flag missing, duplicate, and template-mangled titles first — they are pure waste. Then review the titles of your top-traffic and top-opportunity pages individually: does the primary keyword appear, early, and does the title give a human a reason to click? Title rewrites are, in our experience, the single highest-leverage hour in SEO.
• Meta descriptions. They do not affect rankings, and Google rewrites them more often than not — so audit them only where they earn it: pages with real impressions, where a better pitch moves click-through rate.
• Heading hierarchy. One H1 per page that states the topic; H2s that carve the page into extractable, question-shaped sections; no levels skipped for styling reasons. Headings are load-bearing for both classic featured snippets and AI passage extraction.
• Internal links. The most underrated audit surface. Find orphans (zero inlinks), near-orphans, and the anchor-text habit — if every internal link says "learn more" or "click here", you are spending link equity while withholding the relevance signal. Check that your highest-value pages actually receive the most internal links; on most sites, the homepage's equity pools in the footer instead.
• Images. Alt text where it carries meaning, compression where LCP says so. Batch work, not urgent — but it belongs on the list.

Cross-reference on-page findings with opportunity data before prioritizing anything. A duplicate title on a page ranking sixth for a commercial query outranks — in priority — a missing H1 on a page nobody searches for.

The content layer audits the strategy the pages embody. This is where the audit shifts from "is the machine working" to "is the machine pointed somewhere useful". Four checks:

1. Quality and thin content. List pages by substance and traffic together. Pages with neither are candidates for consolidation, redirect, or honest deletion — at scale, they drag the engine's perception of the whole domain. The per-page question is brutal but clarifying: if this page did not exist, would anything be lost?
2. Cannibalization. In Search Console, find queries where multiple URLs trade impressions back and forth — neither commits, both underperform. The fixes, in order of preference: differentiate the intent each page serves, consolidate into one stronger page, or canonical/redirect the loser into the winner.
3. Decay. Compare each page's clicks against the same period last year. Content decays by default — competitors publish, SERP features shift, information ages out. Refreshing a decayed page that once earned traffic usually beats writing something new, because the page already holds the history and links a new URL would spend a year earning. The fastest wins live where decay and opportunity overlap: pages sitting at positions 4–20, where one good refresh crosses the threshold into real traffic. Striking Distance surfaces exactly that list automatically.
4. Gaps. What do your buyers ask that your site never answers? Map competitor coverage and question research against your URL list, and weight gaps by business value, not just search volume. Gaps are findings too — an audit that only inspects existing pages silently endorses the existing strategy.

First, honesty about scope: an audit diagnoses your link profile; it does not fix it. Earning links is a separate, slower programme — what the audit owes you is an accurate picture and a risk check, not a promise. The sanity checks:

• Trend, not totals. Referring domains over time — growing, flat, or declining — tells you more than any absolute count or third-party authority score. Compare the trend against two or three real competitors for context.
• Concentration. If a large share of your link equity comes from one or two domains, that is fragility worth naming, not a strength worth celebrating.
• Anchor text distribution. A natural profile is dominated by brand and bare-URL anchors. Heavy exact-match commercial anchors are usually the residue of old link buying — worth knowing about before an algorithm makes them your problem.
• Obvious spam. Scan for link networks, irrelevant foreign-language directories, and sitewide footer links from unrelated sites. Note them. Do not panic over them.

On disavowing: be conservative. Google has said for years that it largely ignores spammy links rather than penalizing sites for them, and in our experience, disavow files built from third-party "toxicity" scores do more harm than the links they target. Disavow when you have a manual action or clear evidence of a link-based problem — otherwise, record the observation and move on. The productive output of the authority layer is usually not link surgery; it is the competitor gap analysis that tells the content team what actually earns links in your market.

If the business serves a geography, the audit grows a local layer. These are manual checks — fifteen minutes with a browser, no special tooling required:

• Google Business Profile basics. Is the profile claimed? Is the primary category the most specific accurate one — a "personal injury attorney", not a "lawyer"? Are hours, phone, and website current? Are the photos real and recent, and is anyone responding to reviews? You are not auditing review strategy here — just whether the profile is alive, accurate, and owned.
• NAP consistency. Name, address, and phone number should be character-identical across your site, the Business Profile, and the major directories and data aggregators. Mismatches — old addresses, tracking numbers, an "LLC" present in one place and absent in another — fragment the entity engines are trying to resolve. This matters double now: AI assistants answering "best X near me" lean on the same entity data, and an entity engines cannot confidently resolve is one they will not confidently recommend.
• On-site local signals. A real, substantive page per location — not a templated paragraph with the city name swapped — with LocalBusiness schema whose NAP matches everything else, and an embedded map. If ten location pages share 95% of their copy, expect engines to index one and ignore nine.

An audit's value is decided here. A hundred findings honestly triaged become a plan; a hundred findings dumped in tool-severity order become a PDF that dies in a shared drive. Score every finding on two axes — impact and effort — and let the quadrant dictate the sequence:

Impact is reach times severity. Reach: how many pages, sessions, and conversions does the issue touch — a template-level bug beats a page-level one by orders of magnitude. Severity: does it block indexing entirely (a stray noindex, a blocked crawler), degrade performance (redirect chains, failing LCP), or merely shave polish (a missing meta description)? A site-wide blocker outranks everything; nothing else gets discussed until it ships.

Then convert the top of the list into actual work. Each item gets an owner, an effort estimate, and one sentence stating the expected result — "fixing the product-template LCP should move ~1,200 pages out of failing Core Web Vitals" is a commitment someone can verify later. Cap the active plan at what realistically ships in a quarter; everything else is backlog, not plan. Aergos does this conversion natively — crawl findings arrive as scored action plans and content tasks rather than a list — but the discipline matters more than the tool: no finding leaves the audit without an owner and a next action.

The honest minimum kit for an SEO audit is two tools, both standard for good reason: Google Search Console — free, and the only ground truth for how Google actually crawls and indexes you — and a desktop crawler, where Screaming Frog has been the industry workhorse for over a decade and earns its place. Add PageSpeed Insights for Core Web Vitals field data and you can execute most of this guide by hand.

The cost of the manual kit is not money — it is time and staleness. Point-in-time crawls go stale the week after you run them; cross-referencing crawl exports against Search Console and analytics by hand consumes the hours that should go into fixes; and classic crawlers were never built to ask the AI-readiness questions at all.

That gap is what we built Aergos to close. The Technical SEO module crawls your site like a search engine on a schedule, scores technical health and AI-search readiness side by side — robots.txt, sitemap.xml, llms.txt, Core Web Vitals, AI crawler access — and converts findings into prioritized action plans and content tasks instead of an export. Search Console and GA4 integrations pull impact data in automatically, so triage runs on real traffic instead of guesses. And if you want the instant version before committing to anything: the free instant audit checks any homepage's technical health and AI readiness in seconds, no signup required.

One honest caveat that applies to every tool in this section, ours included: tools find issues; they do not know your business. The judgment in the prioritization section is the part no crawler automates.

The whole guide, compressed into the SEO audit checklist we actually run. Work top to bottom — the order is load-bearing:

1. Crawl. Full crawl following links from the homepage; second pass with JavaScript rendering if the stack warrants it; reconcile crawl vs sitemap vs Search Console index; flag orphans, junk in the index, and pages deeper than four clicks.
2. Indexation. Read every Page indexing exclusion category in Search Console; verify every noindex is intentional; treat "Crawled — currently not indexed" at scale as a quality signal, not a bug.
3. Robots and sitemaps. Read robots.txt line by line against intent; confirm CSS and JS are not blocked; sitemap contains only canonical, indexable, 200-status URLs with honest lastmod dates.
4. Canonicals and redirects. Self-referencing canonicals on indexable pages; nothing canonicalizing to a redirect; kill chains and loops; point internal links at final URLs.
5. Core Web Vitals. CrUX field data per template — LCP, INP, CLS; fix at the template level, where one fix moves a thousand pages.
6. AI readiness. GPTBot, ClaudeBot, and PerplexityBot allowed in robots.txt and at the CDN/WAF; llms.txt present; key content in raw HTML, not just the rendered DOM; entity schema consistent everywhere.
7. On-page. No missing or duplicate titles; money-page titles reviewed by hand; one H1 and question-shaped H2s per page; orphans linked; descriptive anchor text on internal links.
8. Content. Thin pages consolidated or removed; cannibalization resolved; decayed winners refreshed; positions 4–20 mined for fast wins; gaps mapped against buyer questions.
9. Authority. Referring-domain trend versus competitors; anchor distribution sane; concentration risk named; no disavow without evidence.
10. Local (if relevant). Business Profile claimed, correctly categorized, and current; NAP character-identical everywhere; substantive location pages with LocalBusiness schema.
11. Triage. Impact × effort on every finding; blockers first, then quick wins; every surviving item gets an owner, an estimate, and an expected outcome.
12. Re-run. Schedule the next crawl before closing this one. Regressions do not wait for the annual review.

Print it, or let the tooling run the mechanical half for you — either way, the order matters more than the tool.